High severity · published Sep 5, 2022
CVE-2021-28398
A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting…
7.2
CVSS
1.4%
EPSS
No
On KEV
Description
A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure. A User Administrator or Administrator account is required to perform this. This occurs in the runBeforeScript method in harvesters/src/main/java/org/fao/geonet/kernel/harvest/harvester/localfilesystem/LocalFilesystemHarvester.java. The earliest affected version is 3.4.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geonetwork · Osgeo
3.4.0 before 3.12.0; 4.0.0 before 4.0.4; 4.0.0; 4.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-28398
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-28398
Product
https://geonetwork-opensource.org/
Patch
https://geonetwork-opensource.org/manuals/trunk/en/overview/change-log/version-3.6.0.html
Third Party Advisory
https://github.com/geonetwork/core-geonetwork
Mitigation
https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-cf8p-c88c-h9jf
More from Geonetwork
9.1
CVE-2025-30220
GeoServer is an open source server that allows users to share and edit geospatial data
6.5
CVE-2022-50899
Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server
5.3
CVE-2024-32037
GeoNetwork is a catalog application to manage spatially referenced resources